mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
0d0eff39ce
virtnet_poll_cleantx() contains a do-while loop that cleans up
transmitted TX buffers and calls virtqueue_enable_cb_delayed() to check
whether more buffers need processing. When the virtio backend stops
responding during guest reboot, used->idx is never updated, so
virtqueue_enable_cb_delayed() always returns false and the loop never
terminates. Then it will block reboot process, and the guest will hang.
The problem occurs during guest reboot under network traffic:
1. kernel_restart() -> device_shutdown() traverses the device list
2. virtio_dev_shutdown() calls virtio_break_device() which sets
vq->broken = true
3. virtio_dev_shutdown() then calls virtio_synchronize_cbs() to wait
for in-flight callbacks to complete
4. A virtio interrupt fires, softirq is deferred to ksoftirqd which
calls net_rx_action() -> virtnet_poll() -> virtnet_poll_cleantx()
5. virtnet_poll_cleantx() enters the do-while loop and never exits
because the QEMU backend has stopped updating used->idx, despite
vq->broken having been set to true in step 2.
Since the loop runs inside ksoftirqd (a SCHED_OTHER kthread), it is
visible to the scheduler and does not trigger a hard lockup. However,
the kthread never leaves the loop, so RCU detects it as a CPU stall
and reports it periodically. Meanwhile, the reboot process remains
blocked in device_shutdown() because virtio_dev_shutdown() cannot
complete its synchronization step, and the guest hangs permanently.
This can be reproduced on a guest with a virtio-net device: run iperf3
traffic in the guest, then trigger reboot. The reboot occasionally hangs
permanently with RCU stall on ksoftirqd.
Observed on ARM64 KVM guest:
CPU#1 RCU stall (ksoftirqd/1), repeated periodically:
virtqueue_enable_cb_delayed_split <- virtnet_poll <- __napi_poll <-
net_rx_action <- handle_softirqs <- run_ksoftirqd <-
smpboot_thread_fn <- kthread
Fix by adding a vq->broken check in virtqueue_enable_cb_delayed(), so
that the loop exits immediately when the device is broken, allowing
the device shutdown to proceed.
Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260716115940.394832-1-yangjinqian1@huawei.com>
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| virtio_anchor.c | ||
| virtio_balloon.c | ||
| virtio_debug.c | ||
| virtio_dma_buf.c | ||
| virtio_input.c | ||
| virtio_mem.c | ||
| virtio_mmio.c | ||
| virtio_pci_admin_legacy_io.c | ||
| virtio_pci_common.c | ||
| virtio_pci_common.h | ||
| virtio_pci_legacy_dev.c | ||
| virtio_pci_legacy.c | ||
| virtio_pci_modern_dev.c | ||
| virtio_pci_modern.c | ||
| virtio_ring.c | ||
| virtio_rtc_arm.c | ||
| virtio_rtc_class.c | ||
| virtio_rtc_driver.c | ||
| virtio_rtc_internal.h | ||
| virtio_rtc_ptp.c | ||
| virtio_vdpa.c | ||
| virtio.c | ||